Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.600.62\))
Subject: Re: Question about UNIX socket connections and SSL
From: Casey & Gina <cg@osss.net>
In-Reply-To: <7F34CCD8-7185-49A9-88A0-DC12D1B1CFCE@yesql.se>
Date: Thu, 13 Jun 2024 15:18:30 -0500
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
 pgsql-general@postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <CB63A97A-E61D-4EE9-AF2E-7DD8109FFB21@osss.net>
References: <5EDB1F7F-569B-48B2-8DCD-44EE17D41F1A@osss.net>
 <1514893.1718219853@sss.pgh.pa.us>
 <1E2A5972-443A-4C7B-88AA-3AE5E6415381@osss.net>
 <7F34CCD8-7185-49A9-88A0-DC12D1B1CFCE@yesql.se>
To: Daniel Gustafsson <daniel@yesql.se>
Archived-At: <https://www.postgresql.org/message-id/CB63A97A-E61D-4EE9-AF2E-7DD8109FFB21%40osss.net>
Precedence: bulk

> On Jun 13, 2024, at 6:47=E2=80=AFAM, Daniel Gustafsson =
<daniel@yesql.se> wrote:
>=20
> While not strictly that, there was a patch not too long ago for =
teaching
> postgres the PROXY protocol.

As I understand it, PROXY protocol support would be nice if one connects =
through haproxy on standalone hosts, so that postgres could show the =
originating app servers as the client_addr / client_hostname.  We used =
to have standalone host haproxies, but moved to haproxy instances on =
each app node for performance and scalability reasons (many app nodes).  =
I guess it could also help if we were to run pgbouncer on the db nodes?

We're using haproxy to route connections to the appropriate database =
nodes - RW connections go to the current master in the cluster, and RO =
are balanced between replicas.  It seems that libpq could allow SSL on =
UNIX sockets which would avoid having to utilize TCP for the local =
connections from the application to haproxy.

Is there any way to utilize sslmode=3Dverify-full through something =
routing connections to the appropriate database instances, whether =
that's with haproxy or something else?

--=20
Thanks,
- Casey=